---
id: CVE-2026-23223
title: 'xfs: fix UAF in xchk_btree_check_block_owner'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfs: fix UAF in xchk_btree_check_block_owner

  We cannot dereference bs->cur when trying to determine if bs->cur
  aliases bs->sc->sa.{bno,rmap}_cur after the latter has b…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa <
    1d411278dda293a507cb794db7d9ed3511c685c6
  - >-
    Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa <
    ed82e7949f5cac3058f4100f3cd670531d41a266
  - >-
    Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa <
    ba5264610423d9653aa36920520902d83841bcfd
  - >-
    Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa <
    1c253e11225bc5167217897885b85093e17c2217
  - Linux 6.9
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:22:45.786541Z'
published: '2026-02-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:22.930Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23223'
references:
  - url: 'https://git.kernel.org/stable/c/1d411278dda293a507cb794db7d9ed3511c685c6'
  - url: 'https://git.kernel.org/stable/c/ed82e7949f5cac3058f4100f3cd670531d41a266'
  - url: 'https://git.kernel.org/stable/c/ba5264610423d9653aa36920520902d83841bcfd'
  - url: 'https://git.kernel.org/stable/c/1c253e11225bc5167217897885b85093e17c2217'
tags:
  - cve.org
epss: 0.0014
epssPercentile: 0.0335
ingestedAt: '2026-11-05T22:38:32.090Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfs: fix UAF in xchk_btree_check_block_owner

We cannot dereference bs->cur when trying to determine if bs->cur
aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed.
Fix this by sampling before type before any freeing could happen.
The correct temporal ordering was broken when we removed xfs_btnum_t.

## Affected

- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < 1d411278dda293a507cb794db7d9ed3511c685c6`
- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < ed82e7949f5cac3058f4100f3cd670531d41a266`
- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < ba5264610423d9653aa36920520902d83841bcfd`
- `Linux >= ec793e690f801d97a7ae2a0d429fea1fee4d44aa < 1c253e11225bc5167217897885b85093e17c2217`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.